Technical Information
Modifies file system
Creates the following files
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\metadata\f0accf77cdcbff39f6191887f6d2d357
- %WINDIR%\serviceprofiles\networkservice\appdata\locallow\microsoft\cryptneturlcache\content\f0accf77cdcbff39f6191887f6d2d357
Network activity
TCP
HTTP GET requests
- http://io###ing.net/forums/clientscript/vbulletin-core.js?v=###
- http://io###ing.net/forums/redbar/misc/io_donor_badge_gold.gif
- http://io###ing.net/forums/customavatars/avatar1786_16.gif
- http://io###ing.net/forums/redbar/buttons/viewpost-right.png
- http://io###ing.net/forums/redbar/misc/quote_icon.png
- http://io###ing.net/forums/customavatars/avatar1899_1.gif
- http://io###ing.net/forums/redbar/statusicon/user-offline.png
- http://io###ing.net/forums/redbar/misc/progress.gif
- http://io###ing.net/stats/sig-40-random.png
- http://io###ing.net/forums/images/smilies/tongue.png
- http://io###ing.net/forums/redbar/misc/io_donor_badge_silver.gif
- http://ti##pic.com/images/goodbye.jpg
- http://io###ing.net/forums/customavatars/avatar2263_1.gif
- http://io###ing.net/forums/redbar/ranks/iorank_iotf2member.gif
- http://io###ing.net/forums/vbseo/resources/images/forum/linkback_about.gif
- http://io###ing.net/forums/vbseo/resources/images/forum/linkback_url.gif
- http://i4#.#inypic.com/24dodo2.gif
- http://io###ing.net/forums/images/misc/navbit-arrow-right.png
- http://io###ing.net/forums/images/gradients/red-down.png
- http://www.an####planet.com/images/users/signatures/blAAAm.jpg
- http://io###ing.net/forums/redbar/buttons/search.png
- http://io###ing.net/forums/redbar/misc/navbit-home.png
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://pa#####.#ooglesyndication.com/pagead/show_ads.js
- http://io###ing.net/forums/redbar/misc/new_server_badge.png
- http://io###ing.net/forums/redbar/misc/gamericons/steam.png
- http://io###ing.net/templates/default/common/images/three_0a.gif
- http://io###ing.net/templates/default/common/images/icons/rss_feed_icon.jpg
- http://io###ing.net/forums/images/misc/quote-left.png
- http://io###ing.net/forums/redbar/statusicon/post_old.png
- http://io###ing.net/forums/redbar/images/gradients/forum_grey_down_gradient.png
- http://io###ing.net/forums/images/misc/black_downward_arrow.png
- http://io###ing.net/forums/images/misc/arrow.png
- http://io###ing.net/templates/default/common/images/icons/status1.gif
- http://io###ing.net/templates/default/common/images/footer_box_bg.gif
- http://io###ing.net/templates/default/common/images/footer_top_bg.jpg
- http://io###ing.net/templates/default/common/images/country/ch.gif
- http://io###ing.net/templates/default/common/images/search_btn_bg.jpg
- http://io###ing.net/templates/default/common/images/country/.gif
- http://io###ing.net/templates/default/common/images/country/us.gif
- http://io###ing.net/forums/cron.php?ra#############
- http://io###ing.net/forums/images/buttons/newbtn_middle.png
- http://io###ing.net/templates/default/common/js/swfobject/swfobject.js
- http://io###ing.net/forums/redbar/buttons/collapse_40b.png
- http://io###ing.net/stats/sig-606-random.png
- http://io###ing.net/forums/customavatars/avatar2094_1.gif
- http://io###ing.net/forums/redbar/misc/gamericons/xfire.png
- http://io###ing.net/forums/customavatars/avatar1986_4.gif
- http://io###ing.net/templates/default/common/images/hide_status.png
- http://io###ing.net/images/new_sponsor.gif
- http://io###ing.net/templates/default/common/images/search_bg.gif
- http://io###ing.net/forums/clientscript/vbulletin_css/style00013l/toolsmenu-ie.css?d=##########
- http://io###ing.net/forums/clientscript/vbulletin_css/style00013l/editor-ie.css?d=##########
- http://io###ing.net/forums/clientscript/vbulletin_css/style00013l/vbulletin-formcontrols-ie.css?d=##########
- http://io###ing.net/forums/clientscript/vbulletin_css/style00013l/vbulletin-chrome-ie.css?d=##########
- http://io###ing.net/forums/clientscript/vbulletin_css/style00013l/vbulletin-ie.css?d=##########
- http://io###ing.net/forums/clientscript/vbulletin_css/style00013l/popupmenu-ie.css?d=##########
- http://io###ing.net/forums/clientscript/vbulletin_md5.js?v=###
- http://io###ing.net/forums/clientscript/yui/connection/connection-min.js?v=###
- http://io###ing.net/forums/clientscript/vbulletin_css/style00013l/lytebox.css
- http://io###ing.net/forums/lytebox/lytebox.js
- http://io###ing.net/forums/steamprofile/steamprofile.js
- http://io###ing.net/templates/default/common/js/iogaming_forums_min.js
- http://io###ing.net/templates/default/common/js/mootools.compressed.js
- http://io###ing.net/templates/default/common/js/jquery-1.4.2.js
- http://io###ing.net/templates/default/common/css/menu.css
- http://io###ing.net/templates/default/common/css/layout-2.1.css
- http://io###ing.net/forums/clientscript/vbulletin_css/style00013l/additional.css?d=##########
- http://io###ing.net/forums/clientscript/vbulletin_css/style00013l/showthread-rollup.css?d=##########
- http://io###ing.net/forums/clientscript/yui/yuiloader-dom-event/yuiloader-dom-event.js?v=###
- http://io###ing.net/forums/clientscript/vbulletin_css/style00013l/main-rollup.css?d=##########
- http://io###ing.net/forums/clientscript/vbulletin_css/style00013l/showthread-ie.css?d=##########
- http://io###ing.net/forums/clientscript/vbulletin_css/style00013l/postbit-ie.css?d=##########
- http://io###ing.net/forums/clientscript/vbulletin_css/style00013l/postlist-ie.css?d=##########
- http://io###ing.net/forums/clientscript/vbulletin_css/style00013l/poll-ie.css?d=##########
- http://io###ing.net/templates/default/common/images/s_bg.gif
- http://io###ing.net/templates/default/common/css/ie7.css
- http://io###ing.net/forums/images/misc/blog/gradient-black-down.png
- http://io###ing.net/images/main/lip.png
- http://io###ing.net/templates/default/common/images/menu_bot_shadow.png
- http://io###ing.net/templates/default/common/images/menu_top_shadow.png
- http://io###ing.net/templates/default/common/images/header_light_effect.jpg
- http://io###ing.net/templates/default/common/images/status_bg.png
- http://io###ing.net/templates/default/common/images/login.gif
- http://io###ing.net/templates/default/common/images/small_logo.jpg
- http://io###ing.net/images/main/navbar_bg.png
- http://io###ing.net/templates/default/common/images/footer_logo.jpg
- http://io###ing.net/templates/default/common/images/three_1a.gif
- http://io###ing.net/templates/default/common/images/google_btn_bg.jpg
- http://oe#1.gq/
- http://www.io###ing.net/images/new_sponsor.gif
- http://io###ing.net/templates/default/common/images/logo.png
- http://io###ing.net/templates/default/common/images/icons/guests.gif
- http://www.go#####analytics.com/ga.js
- http://io###ing.net/templates/default/common/images/icons/members.gif
- http://io###ing.net/templates/default/common/images/icons/total.gif
- http://io###ing.net/templates/default/common/images/pin.png
- http://io###ing.net/templates/default/common/images/body_bg.jpg
- http://mf#o.cf/
- http://io###ing.net/templates/default/common/images/menu_rorate_bg.png
UDP
- DNS ASK io###ing.net
- DNS ASK go#####analytics.com
- DNS ASK oe#1.gq
- DNS ASK mf#o.cf
- DNS ASK of###oatan.com
- DNS ASK microsoft.com
- DNS ASK pa#####.#ooglesyndication.com
- DNS ASK an####planet.com
- DNS ASK i4#.#inypic.com
- DNS ASK ti##pic.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
